<http auto-config="true" use-expressions="true">
<intercept-url pattern="/login" access="permitAll"/>
<intercept-url pattern="/logout" access="permitAll"/>
<intercept-url pattern="/denied" access="hasRole('ROLE_USER')"/>
<intercept-url pattern="/" access="hasRole('ROLE_USER')"/>
<intercept-url pattern="/user" access="hasRole('ROLE_USER')"/>
<intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')"/>
<form-login login-page="/login"
authentication-failure-url="/login/failure"
authentication-success-handler-ref="loginSuccessHandler" />
<access-denied-handler error-page="/denied"/>
<logout invalidate-session="true"
logout-success-url="/logout/success"
logout-url="/logout"/>
</http>
<beans:bean id="customUserDetailsService" class="com......authentication.customUserDetailsService" />
<beans:bean id="loginSuccessHandler" class="com...........authentication.LoginSuccessHandler">
<beans:property name="defaultTargetUrl" value="/onLogin.htm"/>
<beans:property name="alwaysUseDefaultTargetUrl" value="true"/>
</beans:bean>
<authentication-manager>
<authentication-provider user-service-ref="customUserDetailsService" />
<authentication-provider>
<user-service>
<user name="admin" password="admin" authorities="ROLE_USER" />
<user name="superadmin" password="superadmin" authorities="ROLE_USER,ROLE_ADMIN" />
</user-service>
<password-encoder hash="md5"/>
</authentication-provider>
</authentication-manager>